8.2 High
CVSS3
Attack Vector
LOCAL
Attack Complexity
LOW
Privileges Required
HIGH
User Interaction
NONE
Scope
CHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
7.3 High
AI Score
Confidence
Low
0.0005 Low
EPSS
Percentile
18.9%
Package : firmware-nonfree
Version : 20190114+really20220913-0+deb10u2
CVE ID : CVE-2022-27635 CVE-2022-36351 CVE-2022-38076 CVE-2022-40964
CVE-2022-46329
Debian Bug : 1051892
Intel® released the INTEL-SA-00766 advisory about potential security
vulnerabilities in some Intel® PROSet/Wireless WiFi and Killer™ WiFi products
may allow escalation of privilege or denial of service. The full advisory is
available at [1]
[1] https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00766.html
This updated firmware-nonfree package includes the following firmware files:
The updated firmware files might need updated kernel to work. It is encouraged
to verify whether the kernel loaded the updated firmware file and take
additional measures if needed.
CVE-2022-27635
Improper access control for some Intel(R) PROSet/Wireless WiFi and Killer(TM)
WiFi software may allow a privileged user to potentially enable escalation of
privilege via local access.
CVE-2022-36351
Improper input validation in some Intel(R) PROSet/Wireless WiFi and Killer(TM)
WiFi software may allow an unauthenticated user to potentially enable denial of
service via adjacent access.
CVE-2022-38076
Improper input validation in some Intel(R) PROSet/Wireless WiFi and Killer(TM)
WiFi software may allow an authenticated user to potentially enable escalation
of privilege via local access.
CVE-2022-40964
Improper access control for some Intel(R) PROSet/Wireless WiFi and Killer(TM)
WiFi software may allow a privileged user to potentially enable escalation of
privilege via local access.
CVE-2022-46329
Protection mechanism failure for some Intel(R) PROSet/Wireless WiFi software
may allow a privileged user to potentially enable escalation of privilege via
local access.
For Debian 10 buster, these problems have been fixed in version
20190114+really20220913-0+deb10u2.
We recommend that you upgrade your firmware-nonfree packages.
For the detailed security status of firmware-nonfree please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/firmware-nonfree
Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS
Attachment:
signature.asc
Description: PGP signature
8.2 High
CVSS3
Attack Vector
LOCAL
Attack Complexity
LOW
Privileges Required
HIGH
User Interaction
NONE
Scope
CHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
7.3 High
AI Score
Confidence
Low
0.0005 Low
EPSS
Percentile
18.9%